CVE-2026-81830
Received Received - Intake

Windows Interactive Service Path Validation Bypass in OpenVPN

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: OpenVPN Inc.

Description
The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-81830
EUVD
EUVD-2026-72279

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openvpn openvpn From 2.4.0 (inc) to 2.6.22 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OpenVPN versions 2.4.0 through 2.6.22 allows a local authenticated user to bypass the trusted configuration directory constraint by exploiting incorrect file path validation in the Windows interactive service.

Detection Guidance

This vulnerability involves incorrect file path validation in OpenVPN's Windows interactive service. To detect it, check if OpenVPN versions 2.4.0 through 2.6.22 are installed and review service configurations for improper path handling. No specific commands are provided in the context.

Impact Analysis

An attacker with local access could manipulate configuration files to escalate privileges or execute unauthorized actions, potentially compromising the VPN service or system integrity.

Compliance Impact

The vulnerability allows local authenticated users to bypass security constraints, potentially enabling unauthorized access to sensitive data. This could impact compliance with GDPR by risking data confidentiality and HIPAA by exposing protected health information.

Mitigation Strategies

Update OpenVPN to version 2.6.23 or later to address the file path validation issue in the Windows interactive service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81830. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart